CloudMigrations: Introduce RBAC role for migration assistant (#98588)

* CloudMigrations: delete unused code

* CloudMigrations: add access control and protect API + navtree with action

* CloudMigrations: register access control roles

* CloudMigrations: gate frontend based with access control

* CloudMigrations: fix api tests

* CloudMigrations: add docs on new actions and roles

* CloudMigrations: dont interpolate vars to make it more greppable

* CloudMigrations: run prettier

pkg/services/cloudmigration/cloudmigrationimpl/cloudmigration.go

@@ -111,6 +111,7 @@ func ProvideService(
 	pluginStore pluginstore.Store,
 	pluginSettingsService pluginsettings.Service,
 	accessControl accesscontrol.AccessControl,
+	acService accesscontrol.Service,
 	kvStore kvstore.KVStore,
 	libraryElementsService libraryelements.Service,
 	ngAlert *ngalert.AlertNG,
@@ -119,6 +120,10 @@ func ProvideService(
 		return &NoopServiceImpl{}, nil
 	}
 
+	if err := cloudmigration.RegisterAccessControlRoles(acService); err != nil {
+		return nil, fmt.Errorf("registering access control roles: %w", err)
+	}
+
 	s := &Service{
 		store:                  &sqlStore{db: db, secretsStore: secretsStore, secretsService: secretsService},
 		log:                    log.New(LogPrefix),
@@ -137,7 +142,7 @@ func ProvideService(
 		libraryElementsService: libraryElementsService,
 		ngAlert:                ngAlert,
 	}
-	s.api = api.RegisterApi(routeRegister, s, tracer)
+	s.api = api.RegisterApi(routeRegister, s, tracer, accessControl)
 
 	httpClientS3, err := httpClientProvider.New()
 	if err != nil {